EDR: CBFeeds Module Growing Larger Than Expected

Products

• Carbon Black EDR (formerly Cb Response)
• Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

• CBFeeds Modules are growing larger than expected.
• This can be determined by checking the storage being used by checking the size cbfeeds directory:

sudo du -sh /var/cb/data/solr6/*

Environment

• EDR Server: All Supported Versions

Cause

• Typically occurs on systems with custom feeds implemented.
• Deleted reports may be lingering and need to be purged.

Resolution

• Reach out to VMWare CB Support for support on this issue.